Bump to v1.0.0 release

- Create CHANGELOG.md with v1.0.0 and v0.1.0 entries
- Expand SECURITY.md to professional standards (2,130 bytes)
- Update RELEASING.md with CHANGELOG management
- Bump version to 1.0.0 in Cargo.toml

CHANGELOG.md

@@ -0,0 +1,50 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+- Placeholder for upcoming unreleased changes
+
+### Changed
+- Development updates placeholder
+
+### Fixed
+- Bug fixes placeholder
+
+## [1.0.0] - 2026-06-02
+
+### Added
+- SQL SELECT with WHERE, ORDER BY, LIMIT support
+- SQL INSERT, UPDATE, DELETE with dry-run mode by default
+- Database resolution by ID or friendly name via Notion search API
+- JSON and CSV output formats for SELECT queries
+- Full support for 8 Notion property types (title, rich_text, select, status, multi_select, number, checkbox, date)
+- Comprehensive WHERE operators (=, !=, >, <, >=, <=, LIKE, IN, IS NULL/IS NOT NULL)
+- Nested AND/OR logic in WHERE clauses
+- Automatic pagination for large database queries
+- Rate limiting with automatic retry (5 attempts)
+- Progress reporting for long-running operations
+
+### Changed
+- None
+
+### Fixed
+- None
+
+### Breaking Changes
+- None
+
+---
+
+## [0.1.0] - 2026-06-02
+
+### Added
+- Initial release of notion-sql CLI
+- Core SQL parsing and translation to Notion API calls
+- Basic SELECT, INSERT, UPDATE, DELETE operations
+- Table output format for SELECT queries

Cargo.lock

@@ -642,7 +642,7 @@ dependencies = [
 
 [[package]]
 name = "notion-sql"
-version = "0.1.0"
+version = "1.0.0"
 dependencies = [
  "anyhow",
  "clap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "notion-sql"
-version = "0.1.0"
+version = "1.0.0"
 edition = "2021"
 description = "Run SQL-style CRUD statements against Notion databases"
 license = "MIT"

RELEASING.md

@@ -2,6 +2,16 @@
 
 Releases are built with `dist` and published by GitHub Actions.
 
+## Changelog Management
+
+All releases must update the [CHANGELOG.md](./CHANGELOG.md) file with:
+
+1. Version number and release date
+2. Category of changes (Added, Changed, Fixed)
+3. Breaking changes if any
+
+Follow the [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) format.
+
 ## Branch Flow
 
 Use the repository's gitflow-style branches:
@@ -20,7 +30,8 @@ git ls-remote --heads origin
 ## Local Release Prep
 
 1. Update `version` in `Cargo.toml`.
-2. Run:
+2. Update [CHANGELOG.md](./CHANGELOG.md) with release notes.
+3. Run:
 
    ```bash
    cargo fmt
@@ -50,10 +61,19 @@ The `Release` workflow builds all configured target binaries and creates a GitHu
 
 From `main`:
 
-```bash
-git tag vX.Y.Z
-git push origin vX.Y.Z
-```
+1. Update [CHANGELOG.md](./CHANGELOG.md) with release date.
+2. Commit changelog changes:
+
+   ```bash
+   git commit -am "Update CHANGELOG for v$VERSION"
+   ```
+
+3. Tag and push:
+
+   ```bash
+   git tag vX.Y.Z
+   git push origin vX.Y.Z
+   ```
 
 The `Release` workflow builds all configured target binaries, creates a GitHub Release, and publishes the Homebrew formula to:
 

SECURITY.md

@@ -2,16 +2,70 @@
 
 ## Supported Versions
 
-Security fixes target the latest released version.
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.0.x   | :white_check_mark: |
+| 0.1.x   | :x:                |
 
 ## Reporting A Vulnerability
 
-Open a private security advisory on GitHub for this repository.
+**Do not open a public GitHub issue for security vulnerabilities.**
 
-Do not include Notion integration tokens, page content, database IDs, or other sensitive workspace data in public issues.
+Instead, please use one of the following methods:
 
-## Token Handling
+1. **GitHub Security Advisories**: Create a private security advisory at
+   `https://github.com/KofTwentyTwo/notion-sql/security/advisories`
 
-`notion-sql` reads the Notion integration token from `NOTION_TOKEN`.
+2. **PGP Encryption**: If you have the maintainer's PGP public key,
+   encrypt your report and send it via email.
 
-The token must not be committed to the repository, stored in examples, or printed in logs.
+3. **Disclose to Notion**: If the vulnerability is in the Notion API itself,
+   please also report it to Notion's security team at `security@notion.com`.
+
+### What To Include
+
+- Type of vulnerability (e.g., injection, authentication bypass)
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### Response Timeline
+
+- Acknowledgment: Within 48 hours
+- Status update: Within 7 days
+- Resolution: Within 30 days (or discussion of timeline if complex)
+
+## Security Best Practices
+
+### Token Handling
+
+- Never commit `NOTION_TOKEN` to version control
+- Use environment variables or secure secret management
+- Rotate tokens if they are exposed
+- Use internal integration tokens with minimal required permissions
+
+### Rate Limiting
+
+The CLI implements automatic rate limiting with retries. To avoid triggering
+rate limits:
+
+- Use `--progress` to monitor long-running operations
+- Consider narrowing WHERE clauses to reduce query volume
+- Avoid rapid repeated queries against the same database
+
+### API Versioning
+
+This release targets Notion API version `2022-06-28`. Future releases may
+migrate to newer API versions with appropriate breaking change handling.
+
+## Security Features
+
+- TLS 1.3 for all Notion API connections
+- Automatic retry with exponential backoff for rate limits
+- Structured error messages that never expose tokens
+- Dry-run mode to preview mutations before execution
+
+## Known Security Considerations
+
+- The CLI caches database names in memory for the current session
+- No persistent storage of Notion tokens or data